firewall et dhcprelay | trouver dans le tar.gz de dhcp3

firewall et dhcprelay | trouver dans le tar.gz de dhcp3 - réseaux et sécurité - Linux et OS Alternatifs

Marsh Posté le 15-01-2004 à 17:29:00    

Bonjour,
J'ai un petit probleme ;)
J'ai un dhcrelay qui tourne sur ma passrelle/firewall,  
Malhereusement :  

Code :
  1. $IPT -A INPUT -p tcp -m owner --pid-owner $dhcrelay -j ACCEPT
  2.   $IPT -A OUTPUT -p tcp -m owner --pid-owner $dhcrelay -j ACCEPT


 
me revoie invalide argument pour la chaine INPUT, ca semble logique mais ca m'embete fortement ...
Comment puis je configurer le bordel ? je ne vois pas du tout comment m'en sortir ...
 
 
merci d avance


Message édité par GUG le 15-01-2004 à 19:54:04
Reply

Marsh Posté le 15-01-2004 à 17:29:00   

Reply

Marsh Posté le 15-01-2004 à 19:54:10    

                           FIREWALL RULES
 
If you are running the DHCP server or client on a computer that's also
acting as a firewall, you must be sure to allow DHCP packets through
the firewall.  In particular, your firewall rules _must_ allow packets
from IP address 0.0.0.0 to IP address 255.255.255.255 from UDP port 68
to UDP port 67 through.  They must also allow packets from your local
firewall's IP address and UDP port 67 through to any address your DHCP
server might serve on UDP port 68.  Finally, packets from relay agents
on port 67 to the DHCP server on port 67, and vice versa, must be
permitted.
 
We have noticed that on some systems where we are using a packet
filter, if you set up a firewall that blocks UDP port 67 and 68
entirely, packets sent through the packet filter will not be blocked.
However, unicast packets will be blocked.   This can result in strange
behaviour, particularly on DHCP clients, where the initial packet
exchange is broadcast, but renewals are unicast - the client will
appear to be unable to renew until it starts broadcasting its
renewals, and then suddenly it'll work.   The fix is to fix the
firewall rules as described above.

Reply

Sujets relatifs:

Leave a Replay

Make sure you enter the(*)required information where indicate.HTML code is not allowed